Q79 — AWS SAA-C03 Ch.16

Question 79 of 100 | ← Chapter 16

Q1279. A company has deployed an application to a group of Amazon EC2 instances. The company's credential management system uses on- premises Active Directory domain controllers. The company needs a solution that allows developers to use existing Active Directory credentials to manage the Amazon EC2 instances by assuming an IAM role.Which solution will meet these requirements?

Correct Answer: D. Configure the on-premises Active Directory controllers to use Active Directory Federation Services(AD FS). Configure AWS IAM Identity Center to connect to AD FS.

Explanation

The correct solution must allow developers to use existing on-premises Active Directory (AD) credentials to assume IAM roles for managing Amazon EC2 instances, with minimal disruption to the current identity system. Let's evaluate each option:Correct Answer: D. Configure the on-premises Active Directory controllers to use Active Directory Federation Services (AD FS). Configure AWS IAM Identity Center to connect to AD FS.Why Option D is Best:Seamless Integration with Existing AD:AD FS enables federated authentication, allowing users to log in with their on-premises AD credentials without migrating accounts.AWS IAM Identity Center (formerly AWS SSO) connects to AD FS to authenticate users and assign IAM roles for EC2 management.IAM Role Assumption:IAM Identity Center allows developers to assume predefined IAM roles (e.g., EC2Admin) when accessing AWS resources.No Migration Required:Unlike Simple AD (C) or third-party IdPs (A), this solution does not require moving users to a new directory.Secure & Compliant:Leverages existing AD policies and AD FS security controls (e.g., MFA).Why Other Options Fail:A. Migrate the developer's Active Directory accounts to a third-party identity provider (IdP) that can generate JSON Web Tokens (JWT).Disruptive Migration:Requires moving users from on-premises AD to a third-party IdP (e.g., Okta, Ping Identity).No Direct IAM Role Integration:While JWTs can be used with AWS Cognito, this does not natively support IAM role assumption for EC2 management.B. Configure a set of EC2 instances to act as Active Directory controllers. Migrate the developers to the new Active Directory instances.High Maintenance & Cost:Running self-managed AD on EC2 requires patching, backups, and scaling.Unnecessary Complexity:The company already has on-premises AD--replicating it in AWS adds overhead. C. Deploy an AWS Directory Service Simple AD directory. Create a trust relationship between Simple AD and the existing Active Directory controllers.Limited Federation Support:Simple AD is a standalone managed directory (compatible with Samba AD) and cannot establish trust relationships with on-premises AD.No IAM Role Assumption:Simple AD does not natively integrate with IAM Identity Center for role-based access.Key Comparison:RequirementAD FS + IAM Identity Center (D)Other OptionsUses existing AD credentials(Federated login via AD FS) (A: Migrates users; B: New AD; C: No trust) Supports IAM role assumption(IAM Identity Center assigns roles) (A: JWT-based; B/C: No native integration)Minimal infrastructure changes(No AD migration/replication) (A: Third-party IdP; B: EC2 AD; C: Simple AD limitations)Conclusion:Option D is the only solution that:Leverages existing on-premises AD without migration.Enables IAM role assumption for secure EC2 management.Integrates with AWS services (IAM Identity Center) for centralized access control.Final Answer: D